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(54) Title: A SECURE CRYPTOGRAPHIC COMMUNICATION SYSTEM USING KEM-DEM 
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(57) Abstract: A secure communication system comprising: a commu- 
nications network; at a sending location on said network: (i) an encapsula- 
ted (1) for providing (a) a session key (K), and (b) plurality of asymmetric 
encryptions of the session key (E1(K), E2(K), E3(K) ... Ei(K) ... En(K)), 
each said encryption corresponding to a respective receiving location (1 
to n) on said network; and (ii) a symmetric encryptor (3) for utilising said 
session key (K) to encrypt a message (M); and, at each said receiving lo- 
cation (1 to n) on said network: (i) a decapsulator (5) for decrypting the 
encryption of said plurality of encryptions ( E1(K), E2(K), E3(K) ... Ei(K) 
... En(K)) which corresponds to that receiving location (1 to n) to provide 
said session key (K); and (ii) a symmetric decryptor (7) for utilising the 
session key (K) to decrypt the message (M), said encapsulator (1) com- 
prising: a pseudo random number generator (51 or 91); symmetric key 
derivation means (55 or 95) for deriving said session key (K) from a first 
random number (N) generated by said pseudo random number generator 
(51 or 91); means (53 or 93) for utilising said first random number (N) to 
generate a second random number (r); and means (57-0 to 57-n and 59-1 
to59-n, or 97-1 to 97-n and 99-1 to 99-(n-l)and 101-(-l)to 101-(n-l)and 
103 and 105 and 107) for utilising the first keys (pkl to pkn, or idl to idn) 
of asymmetric encryption key pairs (pkl to pkn and ski to skn, or idl to 
idn and SI to Sn) of the intended recipients at the receiving locations (1 
to n) together with said second random number (r) and said first random 
number N to generate said plurality of asymmetric encryptions of the ses- 
sion key (E1(K), E2(K), E3 (K) ... Ei(K) ... En(K)), said decapsulator (5) 
at each receiving location (1 to n) comprising: means (71, 73, 75, or 11 1, 
113, 115 or 131, 133, 135, 137, 139, 141) for utilising the second key 
(ski or Si) of the asymmetric encryption key pair (pki and ski, or idi and Si) of the recipient at the receiving location together with 
the asymmetric encryption (Ei(K)) corresponding to the receiving location to recover said first random number (N); and a further 
symmetric key derivation means (77, or 1 17 or 143) for deriving said session key (K) from said first random number (N). 
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